General

  • Target

    TRX8V_782002e0f8ad2bb96d89bf0404ec3a64668960141afef49c0dd9a226eb80bdf6.ps1

  • Size

    453KB

  • Sample

    250128-qmqqsszlfw

  • MD5

    026927d6f8c95796171f4b5726827317

  • SHA1

    02268fbe1e410822d9af6ce9e569818bbbe38f3a

  • SHA256

    782002e0f8ad2bb96d89bf0404ec3a64668960141afef49c0dd9a226eb80bdf6

  • SHA512

    50268beb68995b83ac689fb9dabd839b758fb7260e626d7fdf492d99325ceca94014b1e97f8c7209f5195cf3a75d4efbb2ccc4d561b10ec73d576f39bd219323

  • SSDEEP

    3072:z+PE+NPVFL2bUCUrNlKomLJVlCsspSljq:UE+NPVFL2bUCUrNlKomLJVlCsspSl2

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

00000001

C2

81.10.39.58:7077

Mutex

AsyncMutex_alosh

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      TRX8V_782002e0f8ad2bb96d89bf0404ec3a64668960141afef49c0dd9a226eb80bdf6.ps1

    • Size

      453KB

    • MD5

      026927d6f8c95796171f4b5726827317

    • SHA1

      02268fbe1e410822d9af6ce9e569818bbbe38f3a

    • SHA256

      782002e0f8ad2bb96d89bf0404ec3a64668960141afef49c0dd9a226eb80bdf6

    • SHA512

      50268beb68995b83ac689fb9dabd839b758fb7260e626d7fdf492d99325ceca94014b1e97f8c7209f5195cf3a75d4efbb2ccc4d561b10ec73d576f39bd219323

    • SSDEEP

      3072:z+PE+NPVFL2bUCUrNlKomLJVlCsspSljq:UE+NPVFL2bUCUrNlKomLJVlCsspSl2

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks